Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
143c4ad0066283f32c23d311e61c02e2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
143c4ad0066283f32c23d311e61c02e2.exe
Resource
win10v2004-20231215-en
General
-
Target
143c4ad0066283f32c23d311e61c02e2.exe
-
Size
350KB
-
MD5
143c4ad0066283f32c23d311e61c02e2
-
SHA1
1ddfc575e32e6a35fdfee7df1bf8947d96c89bc4
-
SHA256
5d6441cca42e93d2697dee285c6636a9292dfd8c9e2414aea7ec07b84758d2f4
-
SHA512
b7daceae7088653a0ddfbd2fa2ed4bd5a89b2f5d9e9e821fda079de467b362e766b6ec287288a9d010ead5be46da32ad8b8126b73ca1e70822e2493e193cbe04
-
SSDEEP
6144:T4+FA+BAiMXHQur9MD7Lk9vtXyCLFlINvWLkNGPTd0owmYUUGO56pjPwjw:sW+iMXHknLSvtbDLkNG1w+UG6xw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2248 uninstall.exe -
Loads dropped DLL 4 IoCs
pid Process 2044 143c4ad0066283f32c23d311e61c02e2.exe 2248 uninstall.exe 2248 uninstall.exe 2248 uninstall.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 143c4ad0066283f32c23d311e61c02e2.exe File opened for modification \??\PhysicalDrive0 uninstall.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2248 uninstall.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2044 143c4ad0066283f32c23d311e61c02e2.exe 2248 uninstall.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2044 wrote to memory of 2248 2044 143c4ad0066283f32c23d311e61c02e2.exe 28 PID 2044 wrote to memory of 2248 2044 143c4ad0066283f32c23d311e61c02e2.exe 28 PID 2044 wrote to memory of 2248 2044 143c4ad0066283f32c23d311e61c02e2.exe 28 PID 2044 wrote to memory of 2248 2044 143c4ad0066283f32c23d311e61c02e2.exe 28 PID 2044 wrote to memory of 2248 2044 143c4ad0066283f32c23d311e61c02e2.exe 28 PID 2044 wrote to memory of 2248 2044 143c4ad0066283f32c23d311e61c02e2.exe 28 PID 2044 wrote to memory of 2248 2044 143c4ad0066283f32c23d311e61c02e2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\143c4ad0066283f32c23d311e61c02e2.exe"C:\Users\Admin\AppData\Local\Temp\143c4ad0066283f32c23d311e61c02e2.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\uninstall.exeC:\Users\Admin\AppData\Local\Temp\uninstall.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD556e8f04617f79f704f0fe6c1f5923b04
SHA1d613871ddc8284e77e43e7667adb218388bf6eb7
SHA2564b00db2c3e99e27a49c93eb339cc8c346dd42fac6f43be942b1bcc05fbfc11f6
SHA51282af925382f369e33ea4b5363548a7818c90ecd6c1ee2b52b8040fc297603fce3e2b299a53ccfc60ea0628aeae715c29fe5e90a20881651d1d29d1a69ad0118b
-
Filesize
91KB
MD5ee30ea1c167290153bdb61ecd9b3b590
SHA1b20564a704b4075cf87dd85506599d2a20441274
SHA25645498228c6e045de1dd22d4f285f0c0b51f85964075cf706c6f08e973408fff4
SHA512e110e53824c1d5358911467339368eea31ee8eceefcc7f094acfc5fdc9fc008dd81b4f25c9abcccc2f5bdb9f85da188a73f25b840a28a13d4e337cac37fa0733
-
Filesize
93KB
MD5dd936ea822082d05d3f330167b400aa8
SHA110a12a00fd2ca549e8f1f2b793146537b386c83e
SHA256c53284dd0b0861218265c562a84ebef069dec3572226b74ded66f5ec3f90f985
SHA5121f8c59cd99013e1c62dc5b9f648f1aa10f8ad0defe77ef7dd5dee94518ced2287a5d69ad1144686984ebaabc9b24309c98367037afd0f8ec143f7f0812a6f634
-
Filesize
350KB
MD5143c4ad0066283f32c23d311e61c02e2
SHA11ddfc575e32e6a35fdfee7df1bf8947d96c89bc4
SHA2565d6441cca42e93d2697dee285c6636a9292dfd8c9e2414aea7ec07b84758d2f4
SHA512b7daceae7088653a0ddfbd2fa2ed4bd5a89b2f5d9e9e821fda079de467b362e766b6ec287288a9d010ead5be46da32ad8b8126b73ca1e70822e2493e193cbe04